A number of changes have recently been made to the Consumer Data Right to expand its availability as well as to make it more functional, at the same time as protecting the privacy of consumers.
Action initiation reforms
The Government has introduced the Treasury Laws Amendment (Consumer Data Right) Bill 2022 into the House of Representatives.
UPDATE: The Bill has been referred to the Senate Economics Legislation Committee.
UPDATE: Bill passed by House of Representatives on 15 February 2023.
UPDATE: Bill given Royal Assent on 26 August 2024. See CDR update here.
If passed, the Bill will expand the CDR from a data sharing scheme to introduce ‘action initiation’ reforms, enabling CDR consumers to direct accredited persons (such as financial management and product comparison services) to instruct on actions on their behalf using the CDR framework. These actions could include making a payment, opening and closing an account, switching providers, and updating personal details (such as an address) across providers.
To protect consumers accredited persons must act efficiently, honestly and fairly when initiating CDR
actions.
The privacy safeguards are extended for action initiation to apply to CDR data that flows in the instruction layer from an accredited action initiator to an action service provider.
OAIC CDR Privacy Safeguard Guidelines
The Privacy Commissioner has updated its CDR Privacy Safeguard Guidelines to reflect amendments to the Competition and Consumer (Consumer Data Right) Rules 2020 and the Competition and Consumer Regulations 2010.
The updated guidelines reflect changes including:
• the introduction of energy sector specific rules
• the introduction of new pathways for participation in the Consumer Data Right (CDR), including for CDR representatives, sponsored affiliates and outsourced service providers
• new permitted disclosures to ‘trusted advisers’
• new permitted disclosures of ‘CDR insights’ outside CDR for prescribed purposes.
ACCC enforcement
The ACCC has announced that ING Bank (Australia) Limited has paid penalties totalling $53,280 for allegedly failing to comply with Consumer Data Right (CDR) Rules and making a false or misleading representation to consumers after the ACCC issued it with four infringement notices.
The ACCC alleges that ING Bank missed three important legislated deadlines and made a misleading statement to consumers on its website about the reliability and security of its CDR service.
The ACCC alleges that by failing to meet its obligations, ING potentially denied its customers the full benefits of being able to use the CDR program.
Non-bank lending
The Consumer Data Right (Non-Bank Lenders) Designation 2022 designates the non-bank lending sector as subject to the consumer data right.
Treasury is consulting on Consumer Data Right rules and data standards design paper for the non-bank lending sector.
Guidance on the de-identification of CDR data under the Consumer Data Right
The ACCC has published De-identification of CDR data under the Consumer Data Right Guidance, which outlines the obligations of accredited data recipients (ADRs) in relation to the treatment of de-identified and redundant data under the Competition and Consumer (Consumer Data Right) Rules 2020 and the Competition and Consumer Act 2010.
CDR information map
The CDR information map is a topic-based listing of Consumer Data Right information published by the Commonwealth Treasury, the Australian Competition and Consumer Commission (ACCC), the Australian Office of the Information Commissioner (OAIC) and the Data Standards Body (part of Treasury).
If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.
Author: David Jacobson
Principal, Bright Corporate Law
Email:
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.
